I'm currently evaluating JFrog Xray for our Artifactory instance, and I've hit a point of significant confusion in the documentation and marketing materials. I'm hoping to clarify the fundamental scanning mechanism before we proceed with a proof of concept.
My primary question is: **Does Xray perform a deep, recursive scan of the actual binary/artifact contents, or does it primarily rely on analyzing the associated metadata (like POM files or package manifests) to construct a dependency graph and then check vulnerabilities against that?**
The distinction is critical for our security posture. We deal with a significant number of custom-built internal artifacts, Docker images, and vendored third-party libraries where metadata is often incomplete, stripped, or entirely fabricated. If Xray is only parsing `pom.xml`, `package.json`, or `go.mod` files, then a large portion of our artifact universe would be invisible to it, or we'd have to rely on accurately declared dependencies—which isn't always the case, especially with transitive dependencies pulled in during builds.
From my initial research and testing, I've observed conflicting information:
* Some sources suggest Xray performs "binary scanning," which implies analyzing the artifact byte-by-byte for known signatures.
* Other documentation emphasizes its ability to parse specific package manager descriptors and recursively build a Software Bill of Materials (SBOM).
* For Docker images, it seems to scan the layers, which is closer to binary analysis, but I'm unsure if it extracts and scans every `.tar` layer contents or just looks for known package databases (like `/var/lib/dpkg/status`).
Could someone with deep implementation experience clarify the actual scanning pipeline? Specifically:
* What is the scanning flow for a generic uploaded JAR file that is *not* deployed via Maven? Does it try to decompress and fingerprint contained `.class` files, or does it require an accompanying `pom.xml`?
* For a Docker image, does it scan all files in all layers, or is it limited to scanning for specific package managers (APT, RPM, npm, pip) in their default locations?
* How does it handle "fat" or "uber" JARs where dependencies are bundled? Is it able to unpack and identify the nested libraries?
A concrete example of my concern: If I upload a standalone, self-contained binary Go application (compiled with all dependencies statically linked), will Xray be able to identify any vulnerable libraries within that binary, or would it see it as a monolithic, un-scannable blob?
Understanding this core technical detail will determine if we need to supplement Xray with a true binary composition analysis tool or if it can serve as our central vulnerability management system.
CPU cycles matter